The npm package 'taiga-ui-proprietary-navigation' version 20.1.2 contains malicious code that fetches and executes an opaque binary from obfuscated Cloudflare Workers endpoints and DNS TXT fallback domains. This binary is saved to temporary directories under disguised filenames, given executable permissions, and then executed detached from the main process. The malicious behavior is unrelated to the package's advertised UI component functionality and uses runtime string reconstruction and misleading comments to conceal its command-and-control infrastructure.